Privacy Policy

Depending on how you use Contigress, we may collect:

• Account identifiers from Google or Apple sign-in.
• Your display name and profile photo, if you provide them.
• Your region and language settings (a coarse region detected once from your device locale at sign-up, with no GPS or precise location).
• Goals you create and their visibility settings.
• Check-ins, including text, percentages, and optional photos.
• Comments and cheers (support) interactions.
• Goals you save or follow.
• Reports and moderation signals you submit.
• A device push token, if you enable notifications.
• Basic technical and diagnostic information needed to operate and secure the App.

We do not collect precise location, and we do not run third-party advertising trackers.

We use your data to:

• Provide the App: create your profile, store your goals and check-ins, and show them to the audiences you choose.
• Send notifications you opt into, such as goal reminders.
• Keep the service safe, including reviewing reported content and preventing abuse.
• Maintain, debug, and improve the App.

We do not sell your personal data.

Visibility is your choice for each goal, and check-ins and photos follow the visibility of their goal:

• Private: visible only to you.
• Support circle: visible to the people you invite to that goal.
• Community: visible to any signed-in user of the App.

If you set a goal to community, that content may be seen, saved, or referenced by other users while it remains shared. We do not make private content public. Choose visibility carefully before sharing anything personal.

Photos you attach to a check-in are stored with Google Firebase Cloud Storage and are accessible according to the visibility of the goal they belong to. You can remove or replace your own photos. Removing a photo deletes the stored file on a best-effort basis.

Contigress is built on Google Firebase. Your data is stored and processed by these providers on our behalf:

• Firebase Authentication — account sign-in.
• Cloud Firestore — goals, check-ins, comments, and related data.
• Firebase Cloud Storage — photos you upload.
• Cloud Functions — server-side tasks such as notifications and account deletion.
• Firebase App Check — protecting the backend from abuse.
• Firebase Cloud Messaging — sending notifications you opt into.

These providers process data under Google's terms. We do not currently use third-party product analytics or crash-reporting services; if we add them, we will update this policy first.

Our providers operate globally, so your data may be processed in countries other than your own. Where this happens, we rely on our providers' safeguards for international transfers. [TODO: confirm the configured data region(s) and transfer basis before launch.]

You can edit or delete your own check-ins, photos, and comments at any time. You can delete your account from within the App; this removes your account and associated content, and triggers server-side deletion of your data. Some information may remain in backups for a limited period, or longer where required by law.

We use Firebase security rules, authentication, and App Check to help protect your data. No online service is perfectly secure, and we cannot guarantee absolute security. We do not provide end-to-end encryption.

Contigress is not directed to children under the minimum age required for an online service in their region. If you believe a child has provided us personal data without appropriate consent, contact us so we can address it.

Depending on where you live, you may have rights to access, correct, delete, or export your data, or to object to or restrict certain processing. You can exercise many of these directly in the App, or contact us for help. We will respond consistent with applicable law.

We may update this policy as the App evolves. If we make material changes, we will update the date above and, where appropriate, notify you in the App.

Questions about your privacy can be sent to hello@contigress.app. [TODO: confirm the legal entity name, registered address, and data-protection contact before launch.]